Future Tense

Hackers Can Now Store Malware on DNA

This DNA can hack a computer. And you thought email attachments were scary.

University of Washington

Your DNA is packed with a lot of information, but typically it comes pre-loaded. It’s your DNA, after all. But increasingly, scientists and researchers are learning ways to load all kinds of additional data onto DNA made in labs—including computer viruses.

New research that came out Thursday from the University of Washington demonstrates how hackers were able to encode malware into a short strand of DNA. It was then used to infect and take control of a computer connected to a DNA sequencing machine. And as if that alone isn’t alarming enough, the malware-infused DNA was programmed to launch the virus on its own when the DNA is analyzed. So instead of malware being spread through an email attachment, their research showed that “DNA can be a method of compromising the computer,” said Peter Ney, one of the Ph.D. students who worked on the research team at UW.

As you can probably tell, this hack was very complicated to carry out and, of course, it requires your computer to be connected to a genetic sequencing machine, which you presumably don’t have in your home office.

But the threat here isn’t (currently) to personal computers—it’s to research facilities and DNA sequencing labs. Hypothetically, a malicious actor could send DNA with malware in it to a lab for sequencing. When it’s run through the sequencing system, the malware would be unleashed onto the corresponding computer and take control over that system, where it can read future DNA sequences or even alter genetic data. This isn’t a hack that poses a near danger since it was so complicated to carry out, the researchers say. Still, gene sequencing’s price is dropping rapidly. In 2001, it cost about $100 million to sequence a genome. Now it costs about $1,000, and it will only get cheaper, particularly as the quest for precision medicine continues. The U.S. has a goal of sequencing the DNA of 1 million Americans to learn how to individually tailor medical treatment. So this hack could be a sign of larger problems down the road.

Malware isn’t the only thing that can be coded into DNA. Earlier this year, scientists at Harvard discovered a way to upload a GIF into a DNA sample. The Universal Declaration of Human Rights and 100 works of classic literature have been converted into digital data uploaded onto synthetic DNA. And DNA, it turns out, may be a viable alternative to the ways data is stored now, as companies typically keep digital records on servers in massive, power-hungry data centers. Hard drives and flash drives have relatively short shelf lives and can crash over the course of a few years, but DNA, on the other hand, could potentially store information for thousands of years.

Theoretically, it may even be possible to store files on our own DNA, allowing humans to carry malware or secret files. But it wouldn’t necessarily be easy to extract—not yet anyway.

“Once the DNA is inside you, it would be very difficult to pick that DNA out and amplify that specific piece,” says Yaniv Erlich, a professor at Columbia who previously has shown it’s possible to upload a computer virus or an Amazon gift card on DNA, though he didn’t actually carry out a hack, as the researchers at UW did.

“You might be able to store data on your skin or microbiome,” Erlich said. “If we take bacteria from your own skin, it could carry a file. We can also embed DNA with data into food.” Elrich has also worked on research aimed at making miniature DNA sequencers that are much smaller and more affordable.

If a piece of DNA inside you carries digital files, it doesn’t mean that DNA is going to reproduce all over your body. To do that, the file carrying DNA would probably have to be put into an embryo, and right now most of that kind of research is focused on curing genetic disease.

But the more researchers find ways to store information on DNA and or even hack into sequencer systems to alter results, the more this emerging field of research will need to think about security, too. Anything, it seems, can be hacked—even DNA.

Correction, August 10, 2017: This article originally misspelled Peter Ney’s last name.